Overview

overview

10

Static

static

3

5ac9f39a4b...18.exe

windows7-x64

10

5ac9f39a4b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5ac9f39a4b43c72ca35af491dd020c7b_JaffaCakes118

  • Size

    649KB

  • Sample

    240719-g3xplswfpk

  • MD5

    5ac9f39a4b43c72ca35af491dd020c7b

  • SHA1

    b49b102108565e3e86a7651da4a4310257e0dbc8

  • SHA256

    5bf1003c3c262d95a88880f8aca176a0026e40ea45cda4de2afb9f960864b516

  • SHA512

    21aab98c382ea44a259272027e6a3123f3cd8a35321d54ace1ccb0b262478cd5254c6daad81e70a181cbb84ce169d185ada9f9c3e97744b7f88d54b16ee95387

  • SSDEEP

    12288:W/E5YqFikWeIxCtYSKDYNCKcizF3Z4mxxb1BXc/ThH1d6Vy:WyikWeKXYNtcYQmXZBM/l6Vy

Score
10/10
modiloadertrojan

Malware Config

Targets

    • Target

      5ac9f39a4b43c72ca35af491dd020c7b_JaffaCakes118

    • Size

      649KB

    • MD5

      5ac9f39a4b43c72ca35af491dd020c7b

    • SHA1

      b49b102108565e3e86a7651da4a4310257e0dbc8

    • SHA256

      5bf1003c3c262d95a88880f8aca176a0026e40ea45cda4de2afb9f960864b516

    • SHA512

      21aab98c382ea44a259272027e6a3123f3cd8a35321d54ace1ccb0b262478cd5254c6daad81e70a181cbb84ce169d185ada9f9c3e97744b7f88d54b16ee95387

    • SSDEEP

      12288:W/E5YqFikWeIxCtYSKDYNCKcizF3Z4mxxb1BXc/ThH1d6Vy:WyikWeKXYNtcYQmXZBM/l6Vy

    Score
    10/10
    modiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks